File name:

PluralinputSetup.exe

Full analysis: https://app.any.run/tasks/c9a98adb-5982-4d2f-9843-e871c9e7940c
Verdict: Malicious activity
Analysis date: August 01, 2025, 12:44:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

E8957EA522DC4A16FECA30A50011C5F7

SHA1:

5860991815D8F0316CAB477E60F6FBAC86DF8BEF

SHA256:

13FEF795803907D61816FC60A8DA26A20E6ACDB618A6250BBCA145D4528B37AF

SSDEEP:

98304:lrVZs62yrJqVJKvbq3eDcsmNV9k8R+3v4avuBymzkeVOxskhqCnbu0Mv8YS/Cuf7:ZbbksSi+y5bFTPWI3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 3400)
      • drvinst.exe (PID: 1712)

    • Drops a system driver (possible attempt to evade defenses)

      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 3400)
      • drvinst.exe (PID: 1712)

    • Executable content was dropped or overwritten

      • Update.exe (PID: 4196)
      • PluralinputSetup.exe (PID: 6376)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 3400)
      • drvinst.exe (PID: 1712)

    • Reads security settings of Internet Explorer

      • Update.exe (PID: 4196)
      • RemoteClient.exe (PID: 5968)
      • Pluralinput.UI.exe (PID: 5240)
      • pidrvmgr64.exe (PID: 5188)

    • Creates a software uninstall entry

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Searches for installed software

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Adds/modifies Windows certificates

      • rundll32.exe (PID: 7092)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 3400)

  • INFO

    • Checks supported languages

      • Update.exe (PID: 4196)
      • PluralinputSetup.exe (PID: 6376)
      • RemoteClient.exe (PID: 5968)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • DeviceSetup.exe (PID: 6504)
      • drvinst.exe (PID: 1712)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 3400)
      • Pluralinput.UI.exe (PID: 6764)

    • The sample compiled with english language support

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Create files in a temporary directory

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)
      • pidrvmgr64.exe (PID: 5188)
      • DeviceSetup.exe (PID: 6504)

    • Creates files or folders in the user directory

      • PluralinputSetup.exe (PID: 6376)
      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • DeviceSetup.exe (PID: 6504)

    • Reads the machine GUID from the registry

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Pluralinput.UI.exe (PID: 5240)
      • RemoteClient.exe (PID: 5968)
      • DeviceSetup.exe (PID: 6504)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)

    • Reads the computer name

      • Pluralinput.UI.exe (PID: 6764)
      • RemoteClient.exe (PID: 5808)
      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)
      • RemoteClient.exe (PID: 5968)
      • DeviceSetup.exe (PID: 6504)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • drvinst.exe (PID: 3400)

    • Process checks computer location settings

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Disables trace logs

      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)

    • Checks proxy server information

      • Update.exe (PID: 4196)
      • RemoteClient.exe (PID: 5968)
      • Pluralinput.UI.exe (PID: 5240)

    • Reads the software policy settings

      • RemoteClient.exe (PID: 5968)
      • Update.exe (PID: 4196)
      • Pluralinput.UI.exe (PID: 5240)
      • pidrvmgr64.exe (PID: 5188)
      • drvinst.exe (PID: 1712)
      • rundll32.exe (PID: 7092)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 7092)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 1712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:02:25 17:30:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 111104
InitializedDataSize: 6431232
UninitializedDataSize: -
EntryPoint: 0x9f36
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 0.15.17108.1
ProductVersionNumber: 0.15.17108.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Use multiple mice and keyboards on the same PC at the same time.
FileVersion: 0.15.17108.01
InternalName: Setup.exe
LegalCopyright: Copyright 2017 Christian Gulden
OriginalFileName: Setup.exe
ProductName: Use multiple mice and keyboards on the same PC at the same time.
ProductVersion: 0.15.17108.01
SquirrelAwareVersion: 1
CompanyName: Pluralinput
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
13
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pluralinputsetup.exe update.exe pluralinput.ui.exe no specs remoteclient.exe no specs pluralinput.ui.exe remoteclient.exe devicesetup.exe conhost.exe no specs pidrvmgr64.exe conhost.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
1712DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{2571cee2-b07c-2344-bc34-1100412763e9}\pimou.inf" "9" "49175deeb" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\driver\x64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—DeviceSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3400DrvInst.exe "2" "211" "HID\VID_0627&PID_0001\6&6973F69&0&0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:b2fe4818f103cc24:pimoukbd:1.0.0.0:hid_device_system_mouse," "49175deeb" "00000000000001CC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
4196"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
PluralinputSetup.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.4.4.0
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5188".\Driver\pidrvmgr64.exe" installdevice "C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Driver\x64\pimou.inf" "HID\VID_0627&PID_0001\6&6973F69&0&0000"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Driver\pidrvmgr64.exe
DeviceSetup.exe
User:
admin
Company:
Christian Gulden
Integrity Level:
HIGH
Description:
Pluralinput Driver Manager
Exit code:
0
Version:
0.15.17104.03
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\driver\pidrvmgr64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5240"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Pluralinput.UI.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Pluralinput.UI.exe
Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\pluralinput.ui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5808"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe" --squirrel-install 0.15.17108.01C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe—Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput RemoteClient
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\remoteclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5968"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\RemoteClient.exe
Update.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Pluralinput RemoteClient
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\remoteclient.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6376"C:\Users\admin\AppData\Local\Temp\PluralinputSetup.exe" C:\Users\admin\AppData\Local\Temp\PluralinputSetup.exe
explorer.exe
User:
admin
Company:
Pluralinput
Integrity Level:
MEDIUM
Description:
Use multiple mice and keyboards on the same PC at the same time.
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\temp\pluralinputsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6504"C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exe" -tasksFile="C:\Users\admin\AppData\Local\Temp\tmp13FB.tmp" -resultFile="C:\Users\admin\AppData\Local\Temp\tmp13FC.tmp" -cancellationPipeName=98ee39e9-6483-45b6-8f39-89057c73e957C:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exe
Pluralinput.UI.exe
User:
admin
Company:
Pluralinput
Integrity Level:
HIGH
Description:
Pluralinput DeviceSetup
Exit code:
0
Version:
0.15.17108.01
Modules
Images
c:\users\admin\appdata\local\pluralinput\app-0.15.17108.01\devicesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
31 453
Read events
31 332
Write events
108
Delete events
13

Modification events

(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4196) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
54
Suspicious files
9
Text files
28
Unknown types
16

Dropped files

PID
Process
Filename
Type
6376PluralinputSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\Pluralinput-0.15.17108.01-full.nupkgcompressed
MD5:30D93F75C10C6D51BDA951141DABE909
SHA256:6BAAD91CB8D953FD565BCB2B849B7472BE67999D3EECB31F763A5AED668EC66E
6376PluralinputSetup.exeC:\Users\admin\AppData\Local\SquirrelTemp\RELEASEStext
MD5:061C6FCDDAC20DF43CE492C417698FF5
SHA256:C87512600EA7C20804266DBEFD245DBB6443697887F625BF403FBC4242B520E3
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Caliburn.Micro.Platform.dllexecutable
MD5:A980E5236C1D7AF018D3CAA1268A573F
SHA256:65982AC608FD4DD04679131794B253DB38ADDF512A79F41179157BD5B011ECFE
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Caliburn.Micro.dllexecutable
MD5:5858572545166C9CF3C876697C798B4D
SHA256:F8E2D96BF3611FD69C212A0251A6247F7DBC193DA0CE640299D5F8CDF5DBA24A
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeltaCompressionDotNet.MsDelta.dllexecutable
MD5:C848A2F5FA5FEAA71409795E8E8C69D0
SHA256:1CE872ED466A8A3466C808A7BABF3B597EC12E1CB84870E7A0CF00B2F5EF6DF4
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\ICSharpCode.SharpZipLib.dllexecutable
MD5:F2BF7155CDB0F7E7ED3AF446BA588D8E
SHA256:B6BC2CCDD4E72C087B5D9D19E29F5069310EEF5ADE4B42D367960997433F0C05
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Microsoft.HockeyApp.Core45.dllexecutable
MD5:B71C8CFBB6E5D6CAEFFA27BDE7E11DA3
SHA256:7D232981C3B130C0B88AA33A525932D4E854C2E62713280B2D453E7C9C7F8190
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exeexecutable
MD5:BA48E6DE755592E5170A2CC035F9FB9D
SHA256:162D53E3A77628576F501AE42B9A531A25F92B1C379C6106A3EA8B11D68EE702
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\DeviceSetup.exe.configxml
MD5:C65984FCB82EFFE9966C4854BDAF7987
SHA256:731DDCFFD66564CC57E3FECC578D59C6326DB1789F73625751580CD4CA44095A
4196Update.exeC:\Users\admin\AppData\Local\Pluralinput\app-0.15.17108.01\Hardcodet.Wpf.TaskbarNotification.dllexecutable
MD5:810105219D96749674C5BF31C82A3B09
SHA256:4A2438ECFCAD3E6E7BB942ACF2C40FBE2C0D72E4982DF303AB5828AF26CA753E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
33
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5240
Pluralinput.UI.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5968
RemoteClient.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
151.101.2.133:80
http://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY%2F%2Ft2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc%2BoCMMmsCEhEhNxNTAB%2BcLwHYinGMCaJuMA%3D%3D
unknown
—
—
whitelisted
3944
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3760
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3760
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5968
RemoteClient.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
5240
Pluralinput.UI.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4460
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4196
Update.exe
81.169.145.94:443
pluralinput.com
Strato AG
DE
unknown
5240
Pluralinput.UI.exe
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5968
RemoteClient.exe
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5240
Pluralinput.UI.exe
151.101.194.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
5240
Pluralinput.UI.exe
151.101.2.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
pluralinput.com
  • 81.169.145.94
unknown
crl.microsoft.com
  • 23.216.77.43
  • 23.216.77.15
  • 23.216.77.5
  • 23.216.77.37
  • 23.216.77.41
  • 23.216.77.16
  • 23.216.77.13
  • 23.216.77.38
  • 23.216.77.17
whitelisted
ocsp.globalsign.com
  • 151.101.194.133
  • 151.101.130.133
  • 151.101.2.133
  • 151.101.66.133
whitelisted
ocsp2.globalsign.com
  • 151.101.2.133
  • 151.101.194.133
  • 151.101.66.133
  • 151.101.130.133
whitelisted
dc.services.visualstudio.com
  • 52.188.247.146
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.129
  • 40.126.31.71
  • 40.126.31.128
  • 40.126.31.69
  • 20.190.159.129
  • 20.190.159.64
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted

Threats

No threats detected
Process
Message
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Binding Pluralinput.UI.Views.NotifyIconView and Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.Action] INFO: Setting DC of Pluralinput.UI.Views.NotifyIconView to Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.Action] INFO: Attaching message handler Pluralinput.UI.ViewModels.NotifyIconViewModel to Pluralinput.UI.Views.NotifyIconView.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Attaching Pluralinput.UI.Views.NotifyIconView to Pluralinput.UI.ViewModels.NotifyIconViewModel.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for Handle.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for ShowDashboard.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for ExitApplication.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for get_Parent.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for set_Parent.
Pluralinput.UI.exe
[Caliburn.Micro.ViewModelBinder] INFO: Action Convention Not Applied: No actionable element for get_DisplayName.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PluralinputSetup.exe